Apache: >> Activemq >> 5.11.3 Security Vulnerabilities
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
CVSS Score
7.4
EPSS Score
0.009
Published
2018-09-10
In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.
CVSS Score
6.1
EPSS Score
0.015
Published
2018-01-10
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
CVSS Score
5.4
EPSS Score
0.016
Published
2016-08-05
CVE-2016-3088
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Known exploited
CVSS Score
9.8
EPSS Score
0.943
Published
2016-06-01
Page 3